Struct EncryptionKeyId 

pub struct EncryptionKeyId(/* private fields */);

Encryption key identifier value object for secure key management

This value object provides type-safe encryption key references with comprehensive validation, key rotation support, and environment-aware key management capabilities. It implements Domain-Driven Design (DDD) value object patterns with immutable semantics and business rule enforcement.

Key Features

• Type Safety: Strongly-typed key identifiers that cannot be confused with strings
• Format Validation: Comprehensive validation of key ID format and constraints
• Key Rotation: Built-in support for key versioning and rotation
• Environment Awareness: Automatic detection of production/development environments
• Algorithm Support: Multi-algorithm key identification and validation
• Immutable Semantics: Value objects that cannot be modified after creation

Key ID Format

The key ID follows a structured format: {algorithm}-{version}-{identifier}

Examples

• aes256-v1-prod-2024 - AES-256 production key, version 1
• chacha20-v2-dev-abc123 - ChaCha20 development key, version 2
• rsa2048-v3-staging-key001 - RSA-2048 staging key, version 3

Constraints

• Length: 8-64 characters total
• Characters: Alphanumeric, hyphens (-), underscores (_)
• Structure: Must contain at least 2 separators
• Validation: Cannot start or end with separators

Security Considerations

• Environment Separation: Clear separation between production and development keys
• Access Control: Environment-based access control patterns
• Audit Trail: Complete key usage and lifecycle tracking
• Key Rotation: Regular key rotation with version management

Usage Examples

Cross-Platform Compatibility

• Rust: EncryptionKeyId newtype wrapper
• Go: EncryptionKeyID struct with equivalent interface
• JSON: String representation for API compatibility
• Database: TEXT column with validation constraints

Implementations

impl EncryptionKeyId

pub fn new(key_id: String) -> Result<Self, PipelineError>

Creates a new encryption key ID with format validation

Purpose

Creates a type-safe encryption key identifier with comprehensive format validation. Supports structured key IDs with algorithm, version, and identifier components.

Why

Type-safe key IDs provide:

• Prevention of key management errors
• Structured key versioning and rotation
• Environment separation (production/development)
• Audit trail support

Arguments

• key_id - Key identifier string (format: algorithm-version-identifier)

Returns

• Ok(EncryptionKeyId) - Valid key ID
• Err(PipelineError::InvalidConfiguration) - Invalid format

Errors

• Key ID is empty or < 8 characters
• Key ID exceeds 64 characters
• Contains invalid characters
• Starts/ends with separator
• Missing required components

Examples

pub fn parse(key_id: &str) -> Result<Self, PipelineError>

Creates an encryption key ID from a string slice

pub fn value(&self) -> &str

Gets the key ID string

pub fn algorithm(&self) -> Option<&str>

Extracts the algorithm from the key ID

pub fn version(&self) -> Option<&str>

Extracts the version from the key ID

pub fn identifier(&self) -> Option<&str>

Extracts the identifier portion from the key ID

pub fn is_production(&self) -> bool

Checks if this is a production key

pub fn is_development(&self) -> bool

Checks if this is a development key

pub fn supports_algorithm(&self, algorithm: &str) -> bool

Checks if this key supports the given algorithm

pub fn version_number(&self) -> Option<u32>

Gets the key version number if available

pub fn next_version(&self) -> Result<Self, PipelineError>

Creates a new version of this key for key rotation

Purpose

Generates the next version of the encryption key for key rotation. Automatically increments version number while preserving algorithm and identifier.

Why

Key rotation provides:

• Enhanced security through regular key updates
• Backward compatibility with version tracking
• Automated versioning without manual configuration
• Audit trail of key lifecycle

Returns

• Ok(EncryptionKeyId) - Next version of the key
• Err(PipelineError) - Invalid format or rotation failed

Errors

Returns error if key ID format doesn’t support versioning.

Examples

pub fn validate(&self) -> Result<(), PipelineError>

Validates the encryption key ID

impl EncryptionKeyId

Predefined encryption key ID builders

pub fn aes256(version: u32, identifier: &str) -> Result<Self, PipelineError>

Creates an AES-256 key ID

pub fn chacha20(version: u32, identifier: &str) -> Result<Self, PipelineError>

Creates a ChaCha20 key ID

pub fn production( algorithm: &str, version: u32, identifier: &str, ) -> Result<Self, PipelineError>

Creates a production key ID

pub fn development( algorithm: &str, version: u32, identifier: &str, ) -> Result<Self, PipelineError>

Creates a development key ID

Trait Implementations

impl AsRef<str> for EncryptionKeyId

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for EncryptionKeyId

fn clone(&self) -> EncryptionKeyId

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptionKeyId

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for EncryptionKeyId

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<EncryptionKeyId> for String

fn from(key_id: EncryptionKeyId) -> Self

Converts to this type from the input type.

impl FromStr for EncryptionKeyId

type Err = PipelineError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl Hash for EncryptionKeyId

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for EncryptionKeyId

fn cmp(&self, other: &EncryptionKeyId) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for EncryptionKeyId

fn eq(&self, other: &EncryptionKeyId) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for EncryptionKeyId

fn partial_cmp(&self, other: &EncryptionKeyId) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Eq for EncryptionKeyId

impl StructuralPartialEq for EncryptionKeyId